RU108870U1 - SYSTEM FOR INCREASING THE NUMBER OF DETECTIONS OF MALICIOUS OBJECTS - Google Patents

Abstract

 1. A system for analyzing data obtained as a result of an anti-virus scan, including an anti-virus server connected to at least one personal computer of the user, while the personal computer of the user includes:! a) antiviral agent associated with:! - a base of rules on the side of the user's personal computer; ! - a base of correction factors on the side of the user's personal computer; ! - update tool on the side of the user's personal computer; ! - a tool for processing requests on an anti-virus server; ! at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors; ! b) update tool on the side of the user's personal computer associated with the following tools:! - a base of rules on the side of the user's personal computer; ! - a base of correction factors on the side of the user's personal computer; ! - update tool on the anti-virus server side; ! wherein said updating tool on the side of the user's personal computer is configured to be launched by an anti-virus tool, also said updating tool is intended for updating the rule base and the database of correction factors received from the updating tool on the anti-virus server side; ! c) said rule base on the side of the user's personal computer, containing a set of rules for detecting malicious objects; ! d) the mentioned base of correction factors per side

Description

Technical field

The utility model relates to systems for increasing the number of detections of malicious objects by anti-virus systems that use the rating of processes to detect malicious objects.

State of the art

In connection with the rapid development of computer technology and computer networks, the problem of protecting against malicious objects that enter users' computers is becoming increasingly large.

Currently, many systems are used to solve this problem. Anti-virus systems use different approaches when doing their job: signature verification, heuristic analysis, behavioral analysis.

Signature analysis is a classic method for searching for viruses and other malicious objects. The essence of this approach is the use of samples of program code obtained in the analysis of known malicious code. Samples are called signatures. Virus scanning takes place during the scanning process of potentially dangerous program code. If during scanning a code is found that matches the signature code template, then an object containing such code is classified as malicious. Signature analysis ensures the detection of malicious objects that are described by signatures, but are not able to detect unknown viruses.

Heuristic analysis allows you to determine the presence of harmful data in the data before the launch of the object itself. Behavioral analysis consists in tracking all the processes launched by various objects. In case of suspicious process behavior, which is determined by the rules, the anti-virus system takes protective measures. This method has a drawback: during behavioral analysis, the antivirus system may skip some known viruses.

Modern anti-virus systems successfully use several approaches at once to increase the effectiveness of the fight against malicious objects, taking advantage of each method and mutually compensating for their shortcomings.

A system that uses technology based on the study of executable executable files and the assessment of behavior based on a system of rules is described in patent US 7530106 and is designed to detect viruses and other types of malicious objects using security ratings of computer processes calculated according to the rule system. The rules themselves are formed on the basis of the analysis of the studied malicious objects and the behavior of processes associated with malicious objects. Each rule has a specific structure: rule identifier, called API function (Application Programming Interface, API - a set of ready-made classes, functions, structures and constants provided by the operating system for use in external software applications), conditions for arguments, hazard assessment. That is, the rule will work if the process calls an API function with the appropriate parameters, and in this case the process rating will be increased in accordance with the rule’s assessment.

Rules are stored in updated databases. As new computer viruses continuously appear, the system of rules should be periodically updated, reviewed, supplemented.

Any anti-virus system is likely to cause errors during operation. Errors are divided into so-called errors of the first kind and errors of the second kind. Errors of the first kind appear if the anti-virus system detects a malicious object, although in fact the object does not pose any threat. In other words, a false positive occurs. Errors of the second kind with respect to anti-virus systems are associated with the situation when the system does not detect it in the presence of a virus or other malicious object.

Previous systems could make both errors of the first kind, that is, cause false positives, and errors of the second kind, that is, skip and not detect objects that are dangerous for a personal computer. To improve the quality of the antivirus system, there is a need to reduce the likelihood of errors of the first and second kind.

The proposed system has an advantage over the patented system. It allows you to increase the number of malicious objects detected by the anti-virus system. Thus, with an increase in the number of detected objects, the probability of a second kind of error will decrease.

An analysis of the prior art and the possibilities that arise when combining them in one system allows you to get a new result, namely a system for increasing the number of malware detections by anti-virus systems that use the rating of processes to detect malicious objects.

Utility Model Essence

The technical result of this utility model is to increase the number of detections of malicious objects of the anti-virus system, which is achieved by adjusting the ratings set by the rules during the process of detecting malicious objects using corrective coefficients.

This useful model is a system for analyzing data obtained as a result of an anti-virus scan, including an anti-virus server connected to at least one personal computer of the user, while the personal computer of the user includes:

a) an antiviral agent associated with:

- a base of rules on the side of the user's personal computer;

- a base of correction factors on the side of the user's personal computer;

- update tool on the side of the user's personal computer;

- a tool for processing requests on an anti-virus server;

at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors;

b) update tool on the side of the user's personal computer associated with the following tools:

- a base of rules on the side of the user's personal computer;

- a base of correction factors on the side of the user's personal computer;

- update tool on the anti-virus server side;

wherein said updating tool on the side of the user's personal computer is configured to be launched by an anti-virus tool, also said updating tool is intended for updating the rule base and the database of correction factors received from the updating tool on the anti-virus server side;

c) said rule base on the side of the user's personal computer, containing a set of rules for detecting malicious objects;

d) the said base of correction factors on the side of the user's personal computer, containing a set of correction factors for the rules from the rule base;

the anti-virus server includes:

I) a query processing means associated with a data storage means and a means of generating operational ratings, wherein said query processing means is configured to receive data from an anti-virus tool on a user's computer and based on the received reporting data;

II) data storage means associated with the analysis tool and the tool for generating operational ratings, wherein said data storage means is intended to store reports received from the request processing means;

III) a means for generating operational ratings made with the possibility of obtaining a checksum of a suspicious object from the request processing means, while the means for generating operational ratings is also intended to generate an operational rating of the process using the information in the data storage medium and sending it to the anti-virus tool at user's personal computer;

Iv) analysis tool associated with:

- a means of storing a black list;

- a base of correction factors on the anti-virus server side;

- a rule base on the anti-virus server side;

at the same time, the mentioned analysis tool is designed to analyze the data contained in the data storage means, using the checksums in the black list storage tool for analysis, is also intended to form the base of correction factors and the rule base based on the analysis, which allows to increase the number of detections malicious objects of the anti-virus system;

V) said blacklist storage means containing checksums of known malicious objects;

VI) the mentioned rule base on the anti-virus server side, containing a set of rules updated as a result of the analysis tool;

VII) said base of correction coefficients on the anti-virus server side, containing a set of correction coefficients for the rules from the said rule base, updated as a result of the analysis tool;

VIII) anti-virus server-side updater associated with:

- a rule base on the anti-virus server side;

- a base of correction factors on the anti-virus server side;

however, the said update tool on the anti-virus server side is configured to send a new version of the rule base on the anti-virus server side and the correction coefficient database on the anti-virus server side when the update tool is requested on the user's personal computer. In a particular embodiment, the anti-virus tool of the said system is capable of transmitting to the request processing means data containing at least the checksum of the suspicious object on which the rule worked, the rule number that worked, the process rating set by the rule, and the overall process rating.

In a private embodiment, the processes being checked are processes that are called when objects are launched in the operating system of the user's personal computer.

In a private embodiment, the suspicious object is the object that caused the process to receive a rating that was less than a hazard rating but a higher security rating as a result of an anti-virus scan.

In a private embodiment, the malicious object is that object that caused the process to receive a rating that is higher than a hazard rating as a result of an anti-virus scan.

In a particular embodiment, the anti-virus tool of the said system is configured to use a static rating during the check if an operational rating is not generated by the operational rating generation tool.

In a particular embodiment, the anti-virus tool of the said system is configured to determine a static rating from the characteristics of the scan object, which at least include the attributes of the object, the location of the object, size, type of object.

In a particular embodiment, the base of correction factors and the rule base of the said system are made with the possibility of independent updating.

In a private embodiment, the anti-virus tool of the said system is configured to terminate the process caused by a malicious object upon detection of this malicious object.

In a private embodiment, said analysis tool is configured to perform an on-line analysis, as a result of which a database of correction factors is formed on the anti-virus server side.

In a particular embodiment, said analysis tool is configured to perform a general analysis, as a result of which a rule base is formed on the anti-virus server side.

Brief Description of the Drawings

The accompanying drawings are intended to better understand the claimed utility model, form part of this description, illustrate embodiments of the utility model, and together with the description serve to explain the principles of the utility model.

Figure 1 displays the structure of the computer of the user entering the system to increase the number of detections of malicious objects.

Figure 2 illustrates the structure of the anti-virus server system to increase the number of detections of malicious objects.

Figure 3 shows the structure of the storage medium.

Figure 4 shows the process of rating formation during anti-virus scanning.

Figure 5 illustrates the algorithm for anti-virus scanning on a user's personal computer.

6 shows the algorithm of the anti-virus server.

Fig.7 shows the classification of the objects of verification depending on the rating.

Fig. 8 shows an example of a general-purpose computer system on which this utility model can be implemented.

Description of Embodiments

As one of the embodiments of the utility model is considered a system consisting of at least a personal computer of the user 100 and the anti-virus server 160.

Figure 1 shows the structure of the computer of the user entering the system to increase the number of detections of malicious objects.

The user's personal computer 100 contains an anti-virus tool 110 that searches for malicious objects. As an object, for example, an executable file can be considered, when launched, the process starts in the operating system. To detect malicious objects, the antivirus tool scans 140 processes caused by objects. Thus, if an anti-virus tool defines a process as dangerous, then the object that launched this process is malicious. When conducting a process check, a set of rules 132 is used from the rule base on the side of the user's personal computer 130. Rules are a set of descriptions of processes that can pose a threat to the computer. All rules are stored on the user's computer in the form of a rule base 130. Each rule has its own number 131, which is assigned to it for the entire time the rule is used. The rule number is unique and serves to uniquely identify a specific rule.

In addition to the rule base, the user’s personal computer stores a database of correction factors on the side of the user’s computer 120. Correction factors are also used by the antivirus tool in the process of determining malicious objects. In more detail, the process of determining malicious objects will be discussed in the description of Figure 4. Each rule 132 from the rule base 130 corresponds to one coefficient 122 from the coefficient base 120, which has the number 121 corresponding to the rule 131 number.

The rule base and the coefficient base on the user's computer side can be updated. The update is carried out using the update tool on the side of the personal computer 150. Antivirus tool 110 before starting the search for malicious objects launches the update tool, which communicates with the update tool on the side of the anti-virus server 280, transmits information about the database version. The updater on the side of the anti-virus server 280 receives information about the version of the databases and compares it with the version of the available databases on the anti-virus server. If the updater on the side of the anti-virus server 280 determines that a newer version of the databases is available than the one located on the user's personal computer, the updater on the side of the anti-virus server transfers the new version of the databases to the updater on the side of the user's personal computer 150. The updater on to the side of the personal computer 150, the user receives an updated version of the databases and replaces the old databases. Moreover, the coefficient base on the computer side of the user 120 and the rule base on the computer side of the user 130 are updated independently of each other.

The base of coefficients 120 has a size much smaller than the base of rules 130, which allows frequent updates of the base of coefficients, and the use of network resources will not increase as much as if there was a need for frequent updates of the base of rules. Therefore, the use of a separate update mechanism for the coefficient base and the rule base allows reducing the use of network resources with frequent updating of the coefficient base 120.

Anti-virus tool 110 communicates with anti-virus server 160 if it detects a suspicious process and the corresponding suspicious object that caused this process.

Using one of the well-known cryptographic algorithms, such as MD5, MD4, SHA1, SHA256 or CRC32, the anti-virus tool 110 creates a checksum of the suspicious object that caused the detected process, which allows you to uniquely identify the object. Next, the anti-virus tool 110 transmits the checksum along with information about the triggered rule and the rated rating to the anti-virus server 160.

The anti-virus server receives and accumulates the received information. The anti-virus tool 110 also receives an opposite response from the anti-virus server. The anti-virus tool receives an operational process rating as a response, which makes a corrective contribution to the formation of the overall process rating. If there is no possibility of obtaining an operational rating of the process, then instead of it the antivirus tool uses a static rating when detecting malicious objects. The process of forming ratings is described further in the discussion of Figure 4.

If anti-virus tool 110 detects a malicious object, then it terminates the dangerous process associated with this object.

It is worthwhile to dwell in more detail on the classification of objects depending on the rating set for the corresponding process, which is explained using Fig. 7. Three situations are possible: the process rating turned out to be lower than the security threshold 740, in which case the object 710 is considered safe; the process rating exceeded the safety threshold of 740, but did not reach the hazard threshold of 750, in this case, object 720 is considered as suspicious; the rating turned out to be greater than the danger threshold of 750, and object 730 is recognized as containing a threat, that is, malicious. The safety threshold is set depending on the hazard threshold and may be, for example, 50% of the hazard threshold value. It is worth noting that the thresholds are fixed, but the coefficients change, changing the rating set by the rule.

In the described system, objects classified as suspicious are analyzed, which, despite the fact that they have not reached a rating corresponding to the danger threshold, can be dangerous and harmful.

The anti-virus server is depicted in Figure 2. The anti-virus server 160 receives information about all detected suspicious objects from the personal computer of the user 100.

All data from the personal computer 100 is sent to the request processing means 210, which processes the incoming information and places it in the data storage means 220. The request processing means sends the checksum of the object to the operational rating generation tool 270.

The storage medium 220 is a database. In more detail, the data storage means is shown in FIG. 3. The data in the data storage means is structured in a table. Each line contains information about the detected object. The data storage medium contains information received from an anti-virus tool, which consists of at least a checksum of a suspicious object 221, process rating 222, numbers of triggered rules 223 and ratings 224 set by each rule.

Analysis tool 230 processes the accumulated data received from the anti-virus tool and stored in the data storage tool. During processing, a search is carried out for malicious objects by checksums 221. In this case, a blacklist storage facility 240 is used, in which checksums of malicious objects are stored. The analysis tool 230 searches for those checksums that are located in both the data storage tool 220 and the blacklist storage tool. If the checksum is in the storage medium and in the checksum blacklist storage facility, then a suspicious object with such a checksum is malicious. In this case, a second kind of error occurs, since this object was not recognized by the antivirus tool as a malicious object. The proposed system allows to reduce errors of the second kind during anti-virus scanning, thus increasing the number of detections of malicious objects.

After the checksums of suspicious objects are found in the black list and the corresponding objects are recognized as malicious, the analysis tool 230 analyzes the rules that worked during the anti-virus scan of these objects. The analysis establishes the numbers of triggered rules 223, takes into account the overall rating of the process 222 associated with the object, which shows how much the process rating has not reached the threshold value, and also takes into account the rating 224 set by each rule in the formation of the overall rating.

The work of analysis tool 230 can be divided into two stages: conducting an operational analysis of the obtained data on objects and conducting a general analysis. Operational analysis is performed periodically, and the data accumulated over a short time interval, for example, several hours, is examined.

As a result of the operational analysis, a database of correction factors is formed on the side of the anti-virus server 250 for the rules that worked on malicious objects. The base includes only coefficients other than unity, which allows to reduce the size of the base. Thus, the database can be represented in the form of rule numbers 251 and correction factors for them 252. After the formation of the correction factors database on the side of the anti-virus server 250, the database is available for personal computers of users for updating. In its final form, the database has a small size of about 500 bytes, which facilitates the process of frequent updating the database. Using corrective coefficients, the contribution to the process rating formation is changing. Subsequent antivirus scans of objects that were previously detected as suspicious will be detected by antivirus tool 110 as malicious.

General data analysis is less common than operational analysis. When conducting a general analysis, the analysis tool 230 processes the data collected over a specific period of time, for example, a week. As a result of the general analysis, the analysis tool forms the rule base on the side of the anti-virus server 260. The rule base contains the rule numbers 261 and the changed rules 262, which contributed to the rating of malicious objects. The base coefficient is changed, which directly affects the rating set by the rule when malicious objects are detected. Changes may also affect the structure of the rule itself, in which case it is necessary to involve an expert, this procedure is carried out in a semi-automatic mode.

After the rule base on the side of the anti-virus server 260 is formed, the analysis tool 230 resets the correction factors, assigning a single coefficient to the changed rules. Thus, the correction coefficient for the changed rules is equal to one, it can be adjusted according to the results of the changed rules using the database of correction factors. After the formation of the rule base, it is available to users' personal computers for updating.

The databases are updated with the help of the updating tool on the side of the anti-virus server 280, which receives a request from the user's personal computer and, if the databases on the user's personal computer are out of date, sends a new version of the databases to the personal computer.

In a particular embodiment, the correction coefficients may not be reset using analysis tool 230. Updating the base of correction coefficients is often carried out, which will automatically correct the coefficients according to the results of the changed rules as soon as possible.

In the absence of communication with the anti-virus server 160, the anti-virus tool is able to perform anti-virus scanning using the available base of correction factors and the rule base, which are stored on the user's personal computer. If for some reason the base of correction factors and the rule base cannot be updated by the user's computer, then the antivirus tool uses the latest downloaded version of the databases.

The operational rating generation tool 270 receives a checksum of the object from the query processing facility. Having received the checksum, the operational rating generation tool searches for similar checksums in the data storage tool 220, and then sends a response to the anti-virus tool containing the average rating for this object. Anti-virus tool 110 receives a response from the means of forming an operational rating and uses the operational rating instead of a static rating when generating the overall rating of the process caused by the object being checked.

If the anti-virus tool does not have the ability to obtain an operational rating, then the anti-virus analysis of objects uses a static rating, which is generated by the anti-virus tool 110 without the participation of the anti-virus server 160. Such a situation is possible, for example, due to the lack of data about the object of interest in the data storage tool. In more detail, the process of forming the overall rating of the process during the anti-virus scan will be described when considering Figure 4.

Figure 4 shows the process of rating formation during anti-virus scanning. Anti-virus scan is performed by anti-virus tool 110 on a user's computer. The anti-virus tool checks running processes in order to establish their level of danger and conclude that the objects that launched the processes are malicious. In the verification process, the rule base 130 and the coefficient base 120 are used on the side of the user's personal computer. When analyzing a process, several rules 401-403 may work. Each rule has a base coefficient p _i (i = 1 ... n, where n is the number of the last rule), which can change only when the rule itself changes after updating the rule base. The base coefficient laid down in the rule affects the rating set by the rule. However, the rule base 130 is updated less frequently than the base of the correction factors 120. When forming the final rating, the correction factors 404-406 are also taken into account, which help to quickly change the rating of a particular rule. The overall rating is also affected by a static rating of 408. A static rating is determined by the antivirus tool 110 during the initial analysis of the characteristics of an object. Such characteristics of the object as the attributes of the object, the location of the object, its size, type of object, etc. are taken into account.

In one embodiment of the system, instead of a static rating of 408, an operational rating of 409 is used, obtained from the anti-virus server. The operational rating gives a more general idea of the threat that the object under investigation may pose, since the operational rating is formed on the basis of data on the object received from anti-virus tools located on various personal computers. Using the online rating for anti-virus scanning is more effective, therefore, if possible, an online rating is applied, and a static rating is no longer taken into account.

For one process several rules can work at once. Each rule contributes to the final conclusion about whether the process is dangerous. The contribution from each rule consists of two components: the base coefficient p and the correction coefficient k. After the contributions from each rule are summarized, and together with a static rating of 408 or an operational rating of 409, they form the overall rating of the process 407. If the overall rating exceeds the threshold value of 750, the process is considered dangerous, and the corresponding object is malicious. If the threshold value 740 is not reached, then the object is considered safe. If the threshold 750 is not exceeded, but the rating of the process exceeds the threshold 740, then the object is considered suspicious.

Using the correction factors 404-406, the rating set by the rule is changed, therefore, if the rule is often triggered by malicious objects that do not reach the threshold value, then its coefficient can be increased, and therefore, the contribution from such a rule will increase. Such a rule will make a greater contribution to the final rating of process 407. As a result, the number of detected malicious objects will be increased due to objects that did not get the rating earlier and were detected as suspicious by an antivirus tool.

The number of detected malicious objects will also increase when updating the rule base, when the base coefficient or rule structure changes. In this case, the rating p set by the rule will be adjusted so that the rule makes a greater contribution when triggered by malicious objects.

Figure 5 shows the algorithm for conducting antivirus scans on a user's personal computer.

At step 501, the coefficient base 120 and the rule base 130 are updated. The update is performed using the update tool on the side of the personal computer 150 and the update tool on the side of the anti-virus server 280. The update tool on the side of personal computer 150 sends the version of the current databases to the anti-virus server, in response the update tool on the anti-virus server side transfers new versions of the databases 250 and 260, if available. The updater on the side of the personal computer 150 updates the base of coefficients 120 and the base of rules 130, respectively. After updating the databases, the process starts at step 502, and the antivirus tool 110 generates a general security rating based on the rule base, coefficient base, and a static or operational rating at step 503. A security rating is necessary to obtain a conclusion about whether the object that caused the test the process is malicious. After the rating is formed, at step 504, a check is made that the security threshold 740 is exceeded by the existing rating. If the rating exceeded the threshold value of 740, then at step 505, the anti-virus tool 110 sends information about the object that caused the process, the rules that worked and the ratings they set, as well as the overall rating for this process to the anti-virus server 160. Next, at step 506, it is checked whether threshold value 750. The process blocks at step 507 if threshold 750 is exceeded.

If the obtained overall process rating does not exceed the threshold value of 740, then the antivirus tool allows you to continue the process 508, while the overall rating is updated and compared with the threshold value.

Figure 6 shows the algorithm of the anti-virus server.

At step 601, the anti-virus server receives data about the detected objects from the anti-virus tool 110. At step 602, the received data is processed and structured in a form convenient for storage and further analysis in the storage medium 220. The processed data is accumulated in the storage medium in step 603. C a small periodicity, for example, once every few hours, the analysis tool performs an operational analysis of the accumulated data at step 604, after which a database of correction factors at step 605 is formed.

The analysis tool 230 at step 606 performs a general analysis of the data on the responses accumulated over a long period of time, for example, a week. As a result of the general data analysis, a rule base is formed at step 607. At step 605, the data analysis tool resets the correction factors for the changed rules and updates the database of correction factors. After that, the base of correction factors and the rule base are available for download and update.

At step 608, the operational rating generation tool 270 obtains a checksum from the query processing engine 210.

An operational rating is generated by the checksum, which is sent to the antivirus tool on the user's computer at step 609.

As a result of the system’s work, data is collected on detected malicious objects, triggered rules and set ratings coming from the user's computer. The bases for correcting coefficients and rules are being prepared based on these data for those rules that worked on malicious objects. Due to the application of the database of correction factors, as well as due to changes in the rules, an increase in the number of detections of objects containing malicious data is achieved during anti-virus scanning.

Fig. 8 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS), contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the magnetic disk drive interface 33 and the optical drive interface 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media are possible that can store data in a form readable by a computer (solid state drives, flash cards memory, digital disks, random access memory (RAM), etc.).

Computer 20 has a file system 36 where the recorded operating system 35 and additional software applications 37, other software modules 38 and program data 39 are stored. The user is able to enter commands and information into the personal computer 20 via input devices (keyboard 40, mouse pad) 42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature personal computer 20 shown in Fig. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 51 and wide area network (WAN) 52. Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 51 via a network adapter or network interface 53. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network 52, such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

It should be noted that the examples given in the description are explanatory and are not intended to limit the scope and essence of the claimed utility model, which are established in the attached formula.

Claims (11)

1. A system for analyzing data obtained as a result of an anti-virus scan, including an anti-virus server associated with at least one personal computer of the user, while the personal computer of the user includes: a) an antiviral agent associated with: - a base of rules on the side of the user's personal computer; - a base of correction factors on the side of the user's personal computer; - update tool on the side of the user's personal computer; - a tool for processing requests on an anti-virus server; at the same time, the mentioned antivirus tool is designed to check the processes that are called up when objects are launched using the rule base and the base of correction factors; b) update tool on the side of the user's personal computer associated with the following tools: - a base of rules on the side of the user's personal computer; - a base of correction factors on the side of the user's personal computer; - update tool on the anti-virus server side; wherein said updating tool on the side of the user's personal computer is configured to be launched by an anti-virus tool, also said updating tool is intended for updating the rule base and the database of correction factors received from the updating tool on the anti-virus server side; c) said rule base on the side of the user's personal computer, containing a set of rules for detecting malicious objects; d) the said base of correction factors on the side of the user's personal computer, containing a set of correction factors for the rules from the rule base; the anti-virus server includes: I) a query processing means associated with a data storage means and a means of generating operational ratings, wherein said query processing means is configured to receive data from an anti-virus tool on a user's computer and based on the received reporting data; II) data storage means associated with the analysis tool and the tool for generating operational ratings, wherein said data storage means is intended to store reports received from the request processing means; III) a means for generating operational ratings made with the possibility of obtaining a checksum of a suspicious object from the request processing means, while the means for generating operational ratings is also intended to generate an operational rating of the process using the information in the data storage medium and sending it to the anti-virus tool at user's personal computer; Iv) analysis tool associated with: - a means of storing a black list; - a base of correction factors on the anti-virus server side; - a rule base on the anti-virus server side; at the same time, the mentioned analysis tool is designed to analyze the data contained in the data storage means, using the checksums in the black list storage tool for analysis, is also intended to form the base of correction factors and the rule base based on the analysis, which allows to increase the number of detections malicious objects of the anti-virus system; V) said blacklist storage means containing checksums of known malicious objects; VI) the mentioned rule base on the anti-virus server side, containing a set of rules updated as a result of the analysis tool; VII) said base of correction coefficients on the anti-virus server side, containing a set of correction coefficients for the rules from the said rule base, updated as a result of the analysis tool; VIII) anti-virus server-side updater associated with: - a rule base on the anti-virus server side; - a base of correction factors on the anti-virus server side; however, the said update tool on the anti-virus server side is configured to send a new version of the rule base on the anti-virus server side and the correction coefficient database on the anti-virus server side when the update tool is requested on the user's personal computer. 2. The system according to claim 1, in which the antivirus tool is configured to transmit to the query processing means data containing at least the checksum of the suspicious object on which the rule worked, the rule number that worked, the process rating set by the rule, and the overall rating process. 3. The system according to claim 1, in which the checked processes are processes that are called when objects are launched in the operating system of the user's personal computer. 4. The system according to claim 1, in which the suspicious object is that object that caused the process to receive a rating that was less than a hazard rating but a higher security rating as a result of an anti-virus scan. 5. The system according to claim 1, in which the malicious object is the object that caused the process to receive a rating that is higher than the hazard rating as a result of an anti-virus scan. 6. The system according to claim 1, in which the antivirus tool is configured to use a static rating during the audit if an operational rating is not generated by the operational rating generation tool. 7. The system according to claim 6, in which the antivirus tool is configured to determine a static rating according to the characteristics of the scan object, which at least include the attributes of the object, the location of the object, size, type of object. 8. The system according to claim 1, in which the base of correction factors and the base of rules are made with the possibility of independent updates. 9. The system according to claim 1, in which the antivirus tool is configured to complete the process caused by a malicious object upon detection of this malicious object. 10. The system according to claim 1, in which the said analysis tool is configured to perform an on-line analysis, as a result of which a database of correction factors is formed on the side of the anti-virus server. 11. The system according to claim 1, in which the said analysis tool is configured to perform a general analysis, as a result of which a rule base is formed on the side of the anti-virus server.